Keys and their values
List the keys in an environment, and read the version history behind one.
Opening an environment gives you the list of keys it holds. The console calls each one a parameter. The list carries names and version numbers, plus the time each was last set. It carries no values.
The list
Each row shows the key's path and name. Beside it sits the current version number and how long ago somebody set it. A key that mints on demand is marked as such and has no version, because nothing about it is stored. Filtering happens in the box at the top.
Two buttons sit in the header: Set Parameter, and the one that adds a key that mints on demand.
Setting a value
Set Parameter opens a form with three ways in:
- type rows by hand
- paste a
.envand let the console split it - drop the file onto the form
The form knows which names already exist, so it tells you which rows will create a new version rather than a new key.
There is no edit in place. Every write appends a version, and the version number the server assigns is what comes back.
Opening the same page with ?rotate=1 and a path and name locks the address and names the exact version it is about to create. That is the form the Set New Version button on a key sends you to.
One key
Opening a key shows its version history, built from the version rows themselves rather than inferred from the record. Each entry names the version number, who set it, and when.
Nothing on the page reveals a value on its own. Reveal opens the current value on demand, and a history entry can open a previous one. Both are separate, audited reads.
A value penv cannot decrypt is reported as undecryptable. It is never reported as missing. Reporting it as missing would invite you to overwrite a secret you still hold, and the original would become the version you replaced.
Values are encrypted under a key of their own before they are stored, on every plan. Encryption in the cloud has the shape of it and the honest limit.
What each action needs
| Action | Needs | Confirm it is you | Recorded as |
|---|---|---|---|
| Open the key list | secret:read at that environment | No | not recorded |
| Set a value | secret:write at that environment | No | secret.write |
Paste or drop a .env | secret:write at that environment | No | one secret.write per key |
| Reveal the current value | secret:reveal at that environment | Yes | secret.read |
| Reveal a previous version | secret:reveal at that environment | Yes | secret.read.previous |
| Delete a key | secret:delete at that environment | No | secret.delete |
secret:reveal is deliberately separate from secret:read. The Viewer role holds every read permission and is structurally unable to pick up reveal, so somebody can see that a key exists without being able to open it.
Deleting removes the key from the list. The version rows stay, because history is append-only.